Components 


We Make Things Intelligent 


UHF Lite Module 


Setting Baud Rate: 
For setting the baud rate of the UHF lite module, enter the below command 


Baud Rate(bps) 


9600 


19200 


28800 


38400 


57600 


115200 


1. Command introduction 


1.1 Instruction frame format 
A Command is consisting of a frame header (FH), frame type, 
command code, command data length, command parameter 
length, checksum, and frame end. They’re all in hexadecimal. 


For example: 


Header | Type | Command | PL(MSB) | PL(LSB) | Parameter | Checksum 


BB O01 09 
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1.2Command frame type 


Description 


Command frame: send from PC to UHF LITE 
MODULE chip 


Response frame: send from UHF LITE MODULE chip 
to pc 


Notice frame: send from UHF LITE MODULE chip to 
PC 


It will have a response frame to match the command frame. The response frame 
is standing for whether the command is to be operated or not. 


Single polling commands and several times polling commands have related notice 
frames. The amount of the notice frames is according to the reading of the MCU 
and send to pc automatically. It will send one notice frame when the reader reads 
out one tag, and if more tags, then more notice frames. 


2. Firmware command definition 


21 Get the reader module information 


Command frame definition 


Get the reader module information, such as hardware version, software version, 


and manufacturer information. 
Frame type: 0x00 

Command code: 0x03 
parameter : 


hardware version : 0x00 
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software version : Ox01 
manufacture : 0x02 


example : get reader module hardware version information 


Command | PL(MSB) | PL(LSB) | Paramete | Checksum 
r 


01 00 04 


Frame Type: 0x00 

Command: 0x03 

PL: Ox0001 

Parameter: Ox00(get the hardware version) 
Checksum: 0x04 

Response frame type: 0x01 

Command : 0x03 

data: Variable (ASCII code) 

example : hardware version 

response data 0 is the module information type. 
Hardware version : 0x00 

Software version : 0x01 

manufacture : 0x02 


the latter date is the module information ASCII code. 


Get the response of module hardware version information as below: 


Header Type Comman | PL(MSB | PL(LSB) Info Info 
d ) Type 
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AD (‘M’) 


30 (0’) 30 (0))| 20¢*). | S6CV’7)| 31 CI’) | 2EC2).) 300) 


Checksum End 


22 7E 


Frame Type: 0x01 

Command: 0x03 

PL: OxO00B 

Info Type: 0x00 (hardware version) 

Info: 4D 31 30 30 20 56 31 2E 30 30("M100 V1.00” ASCII code) 


Checksum: 0x22 


2.2Single polling command 


Command frame definition: 


finish the polling one time under EPC Classi Gen2 protocol, will operate the 
inventory. The command is not including the Select operation. The speaker will 
be open or close before or after the polling command operation. At Single 
polling Inventory command, Query operate parameter is configurated by 
another command, and the firmware has the initial data. The single polling 


command is as below: 


Header Comman | PL(MSB) | PL(LSB) | Checksu 
d m 


22 22 


Frame Type: 0x00 


Command: 0x22 
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PL: 0x0000 
Checksum: 0x22 
Notice frame definition: 


The chip received single polling command, if it could read the CRC correct tag, 
the MCU will return data consisting of RSSI, PC, EPC, and CRC. If it read an 
EPC of the tag will return a response command, and many tags then many 


response commands. Such as below: 


PL(MSB | PL(LSB PC(MSB 
) ) ) 


BB 00 ulg 34 00 


Header PC(LSB) 


EPC(MSB) 


30 EB 5c 59 


EPC(LS CRC(LS | Checksu 
B) B) m 


70 76 EF 


Frame Type: 0x02 

Command: 0x22 

PL: Ox0011 

RSSI: OxC9 

PC: 0x3400 

EPC: 0x30751FEB705C5904E3D50D70 
CRC: 0x3A76 

Checksum: OXxEF 


RSSI stands for the signal size of the chip input, it’s excluding the antenna gain 
and directional-coupler attenuator, etc. RSSI is the signal strength of chip 
input, it’s hexadecimal, and the unit is dBm. The above RSSI is 0xC9, which 
stands for the chip input signal strength is -55dBm, 
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Response command definition 
If no tag return or return data CRC parity error, will return the error code 0x15, 


such as below: 


Header Command | PL(MSB) | PL(LSB) | Paramete | Checksum 
r 


BB 15 16 


Frame Type: 0x01 
Command: OxFF 
PL: Ox01 
Parameter: Ox15 
Checksum: 0x16 
2.3 Several times polling command 
Command frame definition: 


The command requires chip MCU to go with several times polling Inventory 
operation, the polling times limitation is 0-65535 times. If the polling time is 


10000 times, the command is as below: 


Header PL(MSB) | PL(LSB) | Reserve | CNT(MS | CNT(LS 
d B) B) 


BB 00 03 22 27 10 


Checksum 


83 


Frame Type: 0x00 
Command: 0x27 

PL: 0x0003 
Reserved: 0x22 


CNT: 0x2710 


Checksum: 0x83 


Notice frame definition 
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The format of Several times polling Inventory command response frame and 


single polling Inventory response is the same, such as: 


Header PL(MSB) 


PL(LSB) 


PC(MSB 
) 


PeCESB) 


BB 00 


11 


34 


00 


EPC(MS 
B) 


30 EB 


70 


5C 


59 


EPC(LSB 
) 


CRC(MS 
B) 


CRC(LS 
B) 


Checksu 
m 


70 


Frame Type: 0x02 

Command: 0x27 

PL: Ox0011 

RSSI: OxC9 

PC: 0x3400 

EPC: 0x30751FEB705C5904E3D50D70 
CRC: 0x3A76 

Checksum: OXxEF 


Response frame definition: 


76 


EF 


It no tag return or return data CRC parity error, it will return the error code 


0x15, such as the below: 
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Header PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 
Command: OxFF 
PL: Ox01 
Parameter: 0x15 
Checksum: 0x16 
2.4 Stop several times frame command 
Command frame definition 


During the chip internal MCU is operated several times polling procedure, could 
stop the several times polling operation, not the pause stop, the command is as 
below: 


Header Comman | PL(MSB | PL(LSB | Checksu 
d m 


28 


Frame Type: 0x00 

Command: 0x28 

PL: 0x0000 

Checksum: 0x28 

Response frame command definition: 

If stop the several times polling command operated successfully, the firmware 


will respond as below: 


Command | PL(MSB) | PL(LSB) | Paramete | Checksum 
r 


28 00 2A 


Frame Type: 0x01 


Command: 0x28 


PL: 0x0001 


Parameter: 0x00 


Checksum: O0x2A 


2.5 Set Select parameter command 


Command frame definition: 
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Set the Select parameter, and set the Select mode to 0x02. To send Select 


command before operating the polling. And if our multi-tags, then could do 


polling, reading, and writing only for special tags according to the Select 


parameter. Such as: 


Header 


nd 


PL(MSB) 


PL(LSB) 


SelPara 
m 


Ptr(MSB 
) 


BB 


00 


OC 


00 


13 


01 


00 


Ptr(LSB) 


MaskLe 
n 


Truncat 
e 


Mask(M 
SB) 


20 


60 


00 


30 


EB 


Mask(LS 
B) 


70 


70 


Checksu 
m 


AD 


Frame Type: 0x00 


Command: Ox0C 


PL : Ox0013 


SelParam: 0x01 (Target: 3’b000, Action: 3’b000, MemBank: 2’b01) 
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Ptr: Ox00000020(unit is a bit, not a word) start from EPC bit. 
Mask Length: 0x60(6 words, 96bits) 


Whether Truncate or not: 0x00(0x00 is Disable truncation, 0x80 is Enable 


truncation) 
Mask: 0x30751FEB705C5904E3D50D70 
Checksum: OxAD 


SelParam is with Byte, and Target owns 3bits, Action owns the 3bits in middle, 


and MemBank owns the last 2bits. 

MemBank definition as below: 

2’b00: RFU data storage area of the tag. 

2’b00: EPC data storage area of the tag. 

2’b00: TID data storage area of the tag. 

2’'b00: User data storage area of the tag. 

For target and Action detail definition, please check the EPC Gen2 protocol. 


When the Select Mask length is longer than 80 bits(5 words), send the Select 
command to set all tags under Inventoried Flag with A, SL Fla with ~SL 
condition. Then operate based on Actions that have been chosen. When the 
Select Mask length is shorter than 80 bits(5 words), it will not appear in the 


situation above mentioned. 
Response frame definition: 
When the Select parameter is set successfully, the firmware return as below 


shown: 


Header PL(MSB) | PL(LSB) Checksu 
m 


OE 


Frame Type: 0x01 
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Command: O0x0C 
PL: 0x0001 
Data: 0x00 


Checksum: Ox0E 
2.6 Set Select mode 


Command frame definition: 
If the Select parameter is set successfully already, operate the command will 


set the Select mode. For example, if want to cancel the Select command: 


Header PL(MSB) | PL(LSB) Checksu 
m 


14 


Frame Type: 0x00 

Command: 0x12 

PL: Ox0001 

Command parameter, Select mode: 0x01 
Checksum: 0x14 

Select Mode definition: 


0x00: to choose the special tags by sending a Select command before all 


operations. 
0x01: No sending Select command before tags operation. 


0x02: only send Select command before tag operation(excluding the several 


times polling Inventory tags), such as 


Before Reading, Writing, Locking, and Killing will choose the special tags 
through Select. 


Response frame definition: 
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When canceling or sending the Select command successfully, the firmware 


returns the following: 


Header PL(MSB) | PL(LSB) Checksu 
m 


OE 


Frame Type: 0x01 
Command: 0x0C 
PL: Ox0001 
Data: O0x00(operate successfully) 
Checksum: Ox0E 
2.7 Read the data storage area of the tag 
Command frame definition: 


For a single tag, read the appointed address and length data in the memory 
bank of the tag data storage area. Read the tag data area address offset SA 
and tag data storage length DL, their unit is Word, which is 2Byte/16 Bits. And 
before this command, need to set the Select parameter to make choose the 
appointed tag to write available. If Access Passwords are all”0”, then it will 


not send the Access command. 


Header PL(MSB) | PL(LSB) | AP(MSB 
nd ) 


BB 39 00 09 00 00 


AP(LSB) SA(MSB | SA(LSB) | DL(MSB | DL(LSB) | Checksu 
) ) m 


FF 00 00 00 02 45 


Frame Type: 0x00 
Command: 0x39 


PL : Ox0009 
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Access Password: OxOOOOFFFF 
MemBank: 0x03(User area) 

Tag data area address offset SA: 0x0000 
tag data storage length DL: 0x0002 
Checksum: 0x45 

Response frame definition: 


Read the appointed tag data storage area, and if parity CRC is correct, then 


return as the below: 


Header PL(MSB) | PL(LSB) PC(MSB) | PC(LSB) 


BB 00 13 34 00 


EPC(MS 
B) 


30 EB 70 04 


EPC(LSB_ Data(M Data(LSB 
) SB) ) 


E3 70 12 78 


Checksu 
m 


BO 


Frame Type: 0x01 

Command: 0x39 

PL: 0x0013 

operate tag PC+EPC length UL: Ox0E 
operate PC: 0x3400 


operate EPC: 0x30751FEB705C5904E3D50D70 
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Return Data: 0x12345678 
Checksum: OxBO 


If the tag is not in the appointed zone or the appointed EPC is wrong, will return 


error code 0x09, such as below: 


Header PL(MSB) | PL(LSB) Checksu 
m 


BB OA 


Frame Type: 0x01 

Command: OxFF 

PL: Ox0001 

Error Code: 0x09 

Checksum: Ox0A 

If Access Password is wrong, then the return error code is 0x16 and will return 


the PC+EPC that operated, such as: 


Header PL(MSB) | PL(LSB) PC(MSB 
) 


BB O01 00 10 34 


PC(LSB) EPC(MS 
B) 


00 30 EB 70 


EPC(LSB | Checksu 
) m 


70 75 


Frame Type: 0x01 
Command: OxFF 


PL: 0x0010 
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Error Code: 0x16 

PC+EPC length UL: Ox0E 

PC: 0x3400 

EPC: 0x30751FEB705C5904E3D50D70 
Checksum: 0x75 


If the operate tag returns the Error codes ruled by the EPC Gen2 protocol, the 
response frame will return the error codes returned or after OxAO. Because the 


error codes ruled by EPC Gen2 are valid only with 4bits. 


For example, if the address offset or data length in the command parameter 
sent is not correct, the data reading length is longer than the tag data storage 
length, according to the EPC Gen2 protocol, the tag will return error code 
0x03(storage area is over Memory Overrun). The response frame will return the 
error code 0xA3 and back to the PC+EPC of the operated tag, such as: 


Header PL(MSB) | PL(LSB) PC(MSB 
) 


BB O01 00 10 34 


PC(LSB) EPC(MS 
B) 


00 30 EB 70 


EPC(LSB | Checksu 
) m 


70 02 


Frame Type: 0x01 
Command: OxFF 
PL: 0x0010 

Error Code: OxA3 


PC+EPC length UL: Ox0E 


PC: 0x3400 


EPC: 0x30751FEB705C5904E3D50D70 


Checksum: 0x02 


2.8 Write the Data storage area of the tag 


Command frame definition: 
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For a single tag, read the appointed address and length data in the memory 


bank of the tag data storage area. Read the tag data area address offset SA 
and tag data storage length DL, their unit is Word, which is 2Byte/16 Bits. And 


before this command, need to set the Select parameter to make choose an 


appointed tag to write available. If Access Passwords are all”0”, then it will not 


send the Access command. 


Data length is shorter than 30 words (64bytes/512bits) that be written to the 


data storage area, which means. 


Header 


nd 


PL(MSB) 


PL(LSB) 


AP(MSB 
) 


BB 


00 


49 


00 


OD 


00 


00 


AP(LSB) 


nk 


SA(MSB 
) 


SA(LSB) 


DL(MSB 
) 


DL(LSB) 


DT(MSB 
) 


FF 


03 


00 


00 


00 


02 


12 


DT(LSB) 


Checksu 
m 


Frame Type: 0x00 


78 


6D 


Command code: 0x39 


PL: 0xOO0OD 


Access Password: OxOOQOOFFFF 


MemBank: 0x03 
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Tag data storage offset SA: 0x0000 

DL: 0x0002 

DT: 0x12345678 

Checksum: 0x6D 

Response frame definition: 

After writing the data to the tag data storage area, if the reader chip receives 


the tag return data correctly, the response frame will be as the following: 


Header PL(MSB) | PL(LSB) PC(MSB | PC(LSB) 


) 
BB 00 10 34 00 


EPC(MS 
B) 


30 


EB 


70 


5C 


EPC(LSB 
) 


Paramet 
er 


Checksu 
m 


70 


00 


A9 


Frame Type: 0x01 

Command: 0x49 

PL: 0x0010 

PC+EPC length UL: Ox0E 

PC: 0x3400 

EPC: 0x30751FEB705C5904E3D50D70 
Parameter: Ox00(operated successfully) 
Checksum: OxA9 


If the tag is not in the appointed area or the appointed EPC code is wrong, the 
return error code will be 0x10, such as the below: 


Components 


We Make Things Intelligent 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 

Command: OxFF 

PL: 0x0001 

Parameter: 0x10 

Checksum: Ox0A 

If Access Password is wrong, the return error code is 0x16, and back to the 


PC+EPC of the operated tag, such as the following: 


PL(MSB) | PL(LSB) PC(MSB 
) 


BB 01 00 10 34 


PC(LSB) EPC(MS 
B) 


00 30 EB 70 


EPC(LSB | Checksu 
) m 


70 75 


Frame Type: 0x01 
Command: OxFF 

PL: 0x0016 

Error Code: 0x16 
PC+EPC length UL: Ox0E 
PC: 0x3400 


EPC: 0x30751FEB705C5904E3D50D70 
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Checksum: 0x75 


If the operate tag returns the Error codes ruled by the EPC Gen2 protocol, the 


response frame will return the error codes returned or after OxBO. 


For example, if the address offset or data length in the command parameter 
sent is not correct, the data writing length is longer than the tag data storage 
length, according to the EPC Gen2 protocol, the tag will return error code 
0x03(storage area is over Memory Overrun). The response frame will return the 
error code OxB3 and back to the PC+EPC of the operated tag, such as: 


Header PL(MSB) | PL(LSB) PC(MSB 
) 


BB 01 00 10 34 


PC(LSB) EPC(MS 
B) 


00 30 EB 70 


EPC(LSB | Checksu 
) m 


70 12 


Frame Type: 0x01 

Command: OxFF 

PL: 0x0010 

Error Code: 0xB3 

PC+EPC length UL: Ox0E 

PC: 0x3400 

EPC: 0x30751FEB705C5904E3D50D70 


Checksum: 0x12 


2.9 Lock data storage of tag 
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Command frame definition: 


For a single tag, Lock or Unlock its data storage area. Before sending the 
command, you need to set the Select parameter to choose the appointed tag to 
do the lock operation. For example, if you need to lock Access Password, the 


command is as the following: 


Header 


PL(MSB) 


PL(LSB) 


AP(MSB 
) 


BB 


00 


00 


07 


AP(LSB) 


LD(MSB 
) 


LD(LSB) 


Checksu 
m 


FF 


02 


80 


09 


Frame Type: 0x00 

Command: 0x82 

PL: 0x0007 

Access Password: OxOOOOFFFF 

The lock operates data LD: 0x020080 
Checksum: 0x09 


The high 4 bits of the Lock operate parameter LD is the remaining bit, and the 
last 20 bits are the payload of Lock. (including Mask and Action, each be 10 
bits from the high to the low by turns). For more details please operate 
according to Chapter 6.3.2.11.3.5 of EPC Gen2 protocol 1.2.0 version. 


Mask is a mask off code, the Active will be valid only with the mask bit is 1. The 
activity of each data area has 2 bits, 00~11, it’s the under the turns to be 
open, permanently open, lock, permanent lock. 

For example, Kill Mask is 2bits 00. No matter what’s the Kill Action, Kill Action 

will not take effect. When the Kill Mask is 2bits 10, stands for the Kill Password 

is Locked (No Perma Lock), only could be read through effective Access 


Password. 
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The bit’s definition of Mask and Action is as the following: 


Lock-Command Payload 


DID Bane ne 


Kil 3 Access: EPC : TID : User : Kill : Access: EPC : 3 User 
Mask Mask Mask Mask Mask Action Action Action ine Action 


Masks and Associated Action Fields 


Kill pwd Access 2 TID memory | User sag 
1 18 13 12 11 


Lz a i aa Associated memory bank is writeable from either the open or secured states. 


ae ha Associated memory bank is permanently writeable from either the open or secured states 
and may never be locked. 

Ba Eee Associated memory bank is writeable from the secured state but not from the open state. 
ih ies Associated memory bank is not writeable from any state. 


Associated password location is readable and writeable from either the open or secured 
states. 

Associated password location is permanently readable and writeable from either the open 
or secured states and may never be locked. 

Associated password location is readable and writeable from the secured state but not 
from the open state. 


EE EEE EE ee Associated password location is not readable or writeable from any state. 


Response frame definition: 


If the Lock command operates correctly, the tag return is valid, and the 


response frame is as below: 


Header PL(MSB) | PL(LSB) PC(MSB | PC(LSB) 
) 


BB 00 10 34 00 


EPC(MS 
B) 


30 
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EPC(LSB | Paramet | Checksu 


Frame Type: 0x01 

Command: 0x82 

PL: 0x0010 

PC+EPC length UL: Ox0E 

PC: 0x3400 

EPC: 0x30751FEB705C5904E3D50D70 
Parameter: O0x00O(operate successfully) 
Checksum: OxE2 


If the tag is not in the area or the appointed EPC code is wrong, will return the 


error code 0x13, such as below: 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 
Command: OxFF 
PL: Ox0001 
Parameter: Ox13 
Checksum: 0x14 


If the Access Password is not correct, the return error code is 0x16, and back to 
the PC+EPC of the operate tag, such as the below: 


Header Type Comma | PL(MSB) | PL(LSB) Error UL PC(MSB 
nd Code ) 
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BB O01 


PC(LSB) | EPC(MS 


B) 


00 30 EB 70 


Checksu 


EPC(LSB 
) m 


70 75 


Frame Type: 0x01 

Command: OxFF 

PL: 0x0016 

Error Code: 0x16 

PC+EPC length UL: Ox0E 

PC: 0x3400 

EPC: 0x30751FEB705C5904E3D50D70 
Checksum: 0x75 


If the operate tag returns the error codes ruled by the EPC Gen2 protocol, and 


response frame will return the error code or return after OxCO. 


For example, if the TID has been permanently locked, Set the TID under an open 
situation through the Lock command. According to the EPC Gen2 protocol, the tag 
will return error code 0x04(storage area locked, Memory Locked). The response 
frame return error code 0xC4, and back to PC+EPC of the operated tag, such as: 


Header Type Comma | PL(MSB) | PL(LSB) Error UL PC(MSB 
nd Code ) 
BB O01 FF 00 10 C4 OE 34 
PC(LSB) | EPC(MS 
B) 
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00 30 75 LF EB 70 5C 59 
EPC(LSB | Checksu End 
) m 
04 E3 D5 OD 70 23 7E 


Frame Type: 0x01 


Command: OxFF 
PL: 0x0010 
Command parameter Error Code: 0xC4 
PC+EPC length UL: Ox0E 
PC: 0x3400 
EPC: 0x30751FEB705C5904E3D50D70 
Checksum: 0x23 
Inactivate the tag 
Command frame definition: 


Before the command, you need to set the Select parameter to operate the 


Inactivate for the appointed tags. Inactivate the single tag as below: 


Header 


PL(MSB) 


PL(LSB) 


KP(MSB 
) 


BB 


00 


00 


04 


00 


KP(LSB) 


Checksu 
m 


FF 


Frame Type: 0x00 


67 


Command: 0x65 


PL: 0x0012 


Kill Password: OxXOOOOFFFF 
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Checksum: 0x67 
Response frame definition: 
If the inactivate(kill)command operates successfully, the tag return CRC 


correct, and the response frame is as below: 


Header PL(MSB) | PL(LSB) PC(MSB | PC(LSB) 
) 


BB 00 10 34 00 


EPC(MS 
B) 


30 EB 70 5C 


EPC(LSB | Paramet | Checksu 
) er m 


70 00 C5 


Frame Type: 0x01 

Command: 0x65 

PL: 0x0010 

PC+EPC length UL:0x0E 

PC: 0x3400 

EPC: 0x30751FEB705C5904E3D50D70 

Command Parameter: Ox0O(operate successfully) 

Checksum: OxC5 

If the tag is not in the area or the appointed EPC code is wrong, will return the 


error code 0x12, such as the following: 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 
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Frame Type: 0x01 
Command: OxFF 
PL: Ox0001 
Parameter: 0x12 
Checksum: 0x13 


If the operate tag returns the error codes ruled by the EPC Gen2 protocol, and 


response frame will return the error code or return after OxDO. 


Note: If the tag did not been set with Kill Password, means the Kill Password is 
0, and the tag will not be killed according to the EPC GEN2 protocol. The return 


error code is OxDO, such as: 


Header PL(MSB) | PL(LSB) PC(MSB 
) 


BB O01 00 10 34 


PC(LSB) EPC(MS 
B) 


00 30 EB 70 


EPC(LSB | Checksu 
) m 


70 2F 


Frame Type: 0x01 
Command: OxFF 

PL: 0x0010 

Error Code: OxDO 
PC+EPC length UL: Ox0E 
PC: 0x3400 


EPC: 0x30751FEB705C5904E3D50D70 


Checksum: Ox2F 


Get Query parameter 


Command frame definition: 


Get related Query command parameter. The command is as below: 


Header PL(MSB) | PL(LSB) | Checksu 
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Frame Type: 0x00 
Command: 0x0D 
PL: 0x0000 
Checksum: 0x0D 


Response frame definition: 


If the Query parameter set operated correctly, the response frame is: 


PL(MSB) 


PL(LSB) 


Para(MS 
B) 


Para(LS 
B) 


Checksu 
m 


00 


02 


10 


20 


40 


Frame Type: 0x01 


Command: O0x0D 
PL: 0x0002 
Query Parameter: 0x1020 


Checksum: 0x40 


The parameter is 2bytes, it consists of the detail parameter as below. The 


above response frame-related Query parameter is as the following : 
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DR=8, M=1, TRext=Use pilot tone, Sel=00, Session=00, Target=A, Q=4 
And: 
DR(1 bit): DR=8(1'b0), DR=64/3(1’b1). Only support DR=8 mode 


M(2 bit): M=1(2’b00), M=2(2'b01), M=4(2'b10), M=8(2’'b11). Only support 


M=1 mode 


TRext(1 bit): No pilot tone(1’b0), Use pilot tone(1’b1). Only support Use pilot 
tone(1’b1)mode 


Sel(2 bit): ALL(2’b00/2’b01), ~SL(2’b10), SL(2’b11) 
Session(2 bit): S0(2’b00), $1(2’b01), S2(2’b10), S3(2’b11) 
Target(1 bit): A(1’b0), B(1’b1) 
Q(4 bit): 4’b0000-4’b1111 

2.10 Set Query parameter 
Command frame definition: 


Set the related parameter of the Query command. The parameter is 2bytes, is 


consists of detail parameters as below: 
DR(1 bit): DR=8(1'b0), DR=64/3(1’b1). Only support DR=8 mode 


M(2 bit): M=1(2’b00), M=2(2’b01), M=4(2’b10), M=8(2’b11). Only support 
M=1imode 


TRext(1 bit): No pilot tone(1’b0), Use pilot tone(1’b1). Only support Use pilot 
tone(1’b1)mode 


Sel(2 bit): ALL(2’b00/2’b01), ~SL(2’b10), SL(2’b11) 
Session(2 bit): SO(2’b00), S1(2’b01), S2(2’b10), S3(2’b11) 
Target(1 bit): A(1’b0), B(1’b1) 


Q(4 bit): 4’b0000-4’b1111 


Components 


We Make Things Intelligent 


If DR=8, M=1, TRext=Use pilot tone, Sel=00, Session=00, Target=A, Q=4, the 


command is as below: 


Header 


PL(MSB) 


PL(LSB) 


Para(MS 
B) 


Para(LS 
B) 


Checksu 
m 


00 


02 


10 


20 


40 


Frame Type: 0x00 
Command: OxOE 


PL: 0x0002 


Query Parameter: 0x1020 


Checksum: O0xC6 


Response frame definition: 


If the Query parameter set operated correctly, the response frame is as below: 


Header 


PL(MSB) 


PL(LSB) 


Paramet 
er 


Checksu 


m 


BB 
Frame Type: 0x01 
Command: Ox0E 


PL: 0x0001 


Command Parameter: 0x00 


Checksum: 0x10 


2.11 Get Query Parameter 


Command Frame Definition 


00 


10 


Components 


We Make Things Intelligent 


Get the Query command-related parameter of the firmware. The command is as 
below: 


Header PL(MSB) | PL(LSB) | Checksu 


Frame Type Type: 0x00 

Command Code: 0x0D 

Command Parameter Length PL: 0x0000 
Check Digit Checksum: 0x0D 

Response Frame Definition 


If set the Query parameter command to operate correctly, the response frame 


PL(MSB) | PL(LSB) | Para(MS | Para(LS | Checksu 
B) B) m 


00 02 10 20 40 


Frame Type: 0x01 


Command Code: 0x0D 

Command Parameter Length PL: 0x0002 
Query Parameter: 0x1020 

Checksum: 0x40 


The parameter is 2 bytes, which is joined by the digits of the specific parameter 
below. The above response frame’s corresponding Query parameter is: 


DR=8, M=1, TRext=Use pilot tone, Sel=00, Session=00, Target=A, Q=4 


Among: 


Components 


We Make Things Intelligent 


DR(1 bit): DR=8(1’b0), DR=64/3(1’b1). Only support the DR=8 model 


M(2 bit): M=1(2’b00), M=2(2’b01), M=4(2’b10), M=8(2'b11). Only support 
M=1 model 


TRext(1 bit): No pilot tone(1’b0), Use pilot tone(1’b1). Only support Use pilot 
tone(1’b1) Model 


Sel(2 bit): ALL(2’b00/2'b01), ~SL(2'b10), SL(2’b11) 
Session(2 bit): SO(2’b00), S1(2’b01), S2(2’b10), S3(2’b11) 
Target(1 bit): A(1’b0), B(1’b1) 
Q(4 bit): 4’b0000-4’b1111 

2.11 Get Query Parameter 
Command frame definition 


Set the related parameter of the Query command. The parameter is 2 bytes, 


which is joined by the digits of the specific parameter below. 
DR(1 bit): DR=8(1'b0), DR=64/3(1’b1). Only support the DR=8 model. 


M(2 bit): M=1(2’b00), M=2(2’b01), M=4(2’b10), M=8(2’'b11). Only support the 
M=1 model. 


TRext(1 bit): No pilot tone(1’b0), Use pilot tone(1’b1). Only support Use pilot 
tone(1’b1) model. 


Sel(2 bit): ALL(2’b00/2’b01), ~SL(2’b10), SL(2’b11) 
Session(2 bit): SO(2’b00), S1(2’b01), S2(2’b10), S3(2’b11) 
Target(1 bit): A(1’b0), B(1’b1) 


Q(4 bit): 4’b0000-4’b1111 


If DR=8, M=1, TRext=Use pilot tone, Sel=00, Session=00, Target=A, Q=4, 


then command as below: 


Components 


We Make Things Intelligent 


Header PL(MSB) | PL(LSB) | Para(MS | Para(LS | Checksu 
B) B) m 


00 02 10 20 40 


Frame Type: 0x00 

Command Code: Ox0E 

Command Parameter Length PL: 0x0002 

Query Parameter: 0x1020 

Checksum: 0xC6 

Response Frame Definition 

If set the Query parameter command to operate correctly, the response frame 


is: 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 


BB 


Frame Type: 0x01 
Command code: Ox0E 
Command Parameter Length PL: 0x0001 
Command Parameter: 0x00 
Checksum: 0x10 

2.12 Set Working Place 
Command Frame Definition 


Set the working place of the reader, if it is in China 900MHz frequency, as 


below: 


Components 


We Make Things Intelligent 


Header PL(MSB) | PL(LSB) Checksu 
m 


09 


Frame Type: 0x00 

Command code: 0x07 

Command Parameter Length PL: 0x0001 
Region: 0x01 

Checksum: 0x09 


Country code as below: 


Region Paramete 
r 


China O01 
900MHz 


China 04 
800MHz 


USA 02 


Europe 03 


South Korea 06 


Response Frame Definition 


If the workplace setting is operating correctly, then the response frame is: 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 


BB 


Frame Type: 0x01 
Command code: 0x07 


Command Parameter Length PL: 0x0001 


Components 


We Make Things Intelligent 


Command Parameter: 0x00 
Checksum: 0x09 

2.13. Set Working Channel 
Command Frame Definition 


If the frequency is 900MHz, set the working channel of the reader to 
920.125MHz, as below: 


Header PL(MSB) | PL(LSB) Checksu 


AC 


Frame Type: 0x00 

Command code: 0xAB 

Command Parameter Length PL: 0x0001 
Channel Index: 0x01 


Checksum: OxAC 


China 900MHz channel parameter calculation, Freq_CH is channel frequency: 


CH_Index = (Freq_CH-920.125M)/0.25M 


China 800MHz channel parameter calculation, Freq_CH is channel frequency: 


CH_Index = (Freq_CH-840.125M)/0.25M 


USA channel parameter calculation, Freq_CH is channel frequency: 


CH_Index = (Freq_CH-902.25M)/0.5M 


Components 


We Make Things Intelligent 


Europe channel parameter calculation, Freq_CH is channel frequency: 


CH_Index = (Freq_CH-865.1M)/0.2M 


South Korea channel parameter calculation, Freq_CH is channel frequency: 


CH_Index = (Freq_CH-917.1M)/0.2M 


Response Frame Definition 


If the channel setting operates correctly, then the response frame is: 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 
Command code: OxAB 
Command Parameter Length PL: 0x0001 
Command Parameter: 0x00 
Checksum: 0xAD 
2.14 Get Working Channel 
Command Frame Definition 


In the current working zone of a reader, get the working channel as below: 


Header PL(MSB) | PL(LSB) | Checksu 
m 


BB AA 


Frame Type: 0x00 
Command code: OxAA 


Command Parameter Length PL: 0x0000 


Components 


We Make Things Intelligent 


Checksum: OxAA 
Response Frame Definition 


If the operation to get the channel is correct, then the command frame is: 


PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 
Command code: OxAA 


Command Parameter Length PL: 0x0001 


Command Parameter: Ox00(Channel_IndexW0x00) 


Checksum: OxAC 


China 900MHz channel parameter calculation, Freq_CH is channel frequency: 


Freq_CH = CH_Index * 0.25M + 920.125M 


China 800MHz channel parameter calculation, Freq_CH is channel frequency: 


Freq_CH = CH_Index * 0.25M + 840.125M 


USA channel parameter calculation, Freq_CH is channel frequency: Freq_CH = 
CH_Index * 0.5M + 902.25M 


Europe channel parameter calculation, Freq_CH is channel frequency: Freq_CH 
= CH_Index * 0.2M + 865.1M 


Components 


We Make Things Intelligent 


South Korea channel parameter calculation, Freq_CH is channel frequency: 
Freq_CH = CH_Index * 0.2M + 917.1M 


2.15 Set frequency adjustment automatically 
Command Frame Definition 


Set frequency adjustment automatically mode or cancel frequency adjustment 


automatically mode, as below: 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 


BB 


Frame Type: 0x00 
Command Code: 0xAD 
Command Parameter Length PL: 0x0001 


Command Parameter: OxFF(OxFF is to set frequency adjustment automatically, 


0x00 is to cancel frequency adjustment automatically) 
Checksum: O0xAD 
Response Frame Definition 


If the set or cancel frequency adjustment is automatically correct, then the 


response frame is: 


PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 

Command code: 0xAD 

Command Parameter Length PL: 0x0001 
Command Parameter: 0x00 


Checksum: OxAF 


Components 


We Make Things Intelligent 


2.16 Get transmitting power 


Command Frame Definition 


Get the transmitting power of the reader as below: 


Header PL(MSB) | PL(LSB) | Checksu 
m 


BB B7 


Frame Type: 0x00 

Command code: 0xB7 

Command Parameter Length PL: 0x0000 
Checksum: 0xB7 

Response Frame Definition 


If the operation to get the channel is correct, then the response frame is: 


Header PL(MSB) | PL(LSB) | Pow(MS | Pow(LS | Checksu 
B) B) m 


00 02 07 DO 91 


Frame Type: 0x01 


Command Code: 0xB7 
Command Parameter Length PL: 0x0002 
Power Parameter Pow: 0x07D0(Current power is decimalize 2000, i.e 20dBm) 
Checksum: 0x91 
2.17 Set transmitting power 
Command Frame Definition 


Set the transmitting power of the reader as below: 


Components 


We Make Things Intelligent 


Header PL(MSB) | PL(LSB) | Pow(MS | Pow(LS | Checksu 
B) B) m 


00 02 07 DO 8F 


Frame Type: 0x00 
Command code: 0xB6 
Command Parameter Length PL: 0x0002 


Command Parameter Pow: 0x07D0(Current power is decimalize 2000, i.e 


20dBm) 
Checksum: Ox8F 
Response Frame Definition 


If the operation to get the channel is correct, then the response frame is: 


PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 


Command code: 0xB6 
Command Parameter Length PL: 0x0001 
Command Parameter: 0x00 
Checksum: 0xB8 
2.18 Set transmit a continuous carrier 
Command Frame Definition 


Set transmit continuous carrier or off-set transmit continuous carrier as below: 


Components 


We Make Things Intelligent 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 
m 


BO 


Frame Type: 0x00 
Command Code: 0xBO 
Command Parameter Length PL: 0x0001 


Command Parameter: OxFF (OxFF is to set continuous carrier, 0x00 is to off 


continuous carrier) 
Checksum: OxBO 
Response Frame Definition 


If the setting operation is correct, then the response frame is: 


PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 
Command code: 0xBO 
Command Parameter Length PL: 0x0001 
Command Parameter: 0x00 
Checksum: O0xB2 
2.19 Get the parameter of receiving modem 
Command Frame Definition 


Get the parameter of receiving modem. The modem parameter has Mixer gain, 


IF AMP gain, and signal demodulator value. For example: 


ee a 
nd m 


Components 


We Make Things Intelligent 


Cee ee ee 


Frame Type: 0x00 

Command Code: OxF1 

Command Parameter Length PL: 0x0000 
Checksum: OxF1 

Response Frame Definition 


If the operation to get channel is correct, then the response frame is: 


Header PL(MSB) | PL(LSB) | Mixer_G 2 Thrd(MS 
B) 


BB O01 00 04 03 01 


Checksu 
m 


BO 


Frame Type: 0x01 

Command code: OxF1 

Command Parameter Length PL: 0x0004 

Mixer Gain Mixer_G: 0x03(Mixer Gain is 9dB) 

IF Amplifier IF_G: OxO6(IF Amplifier IF AMP Gain is 36dB) 


Signal demodulator value Third: 0x01BO (The smaller the Signal demodulated 

value is, the less the demodulator tag return to RSSI, but also with less stable; 
it will unable to be demodulated if lower than a certain value; on the contrary, 
the bigger value, the more demodulated tags return to RSSI; the nearer the 


distance, the more stable). 0x01B0 is the recommended smallest value. 
Checksum: 0xBO 


Mixer Gain Chart 


Components 


We Make Things Intelligent 


Mixer G(dB) 


IF AMP Gain Chart 


IF_G(dB) 


12 


18 


21 


24 


27 


30 


36 


40 


2.20 Set the parameter of receiving modem 


Command Frame Definition 


Get the parameter of receiving modem. The modem parameter has Mixer gain, 


IF AMP gain, and signal demodulator value. For example: 


nd SB) 


Components 


We Make Things Intelligent 


BB 00 


Thrd(LS | Checksu 


B) m 


BO AE 


Frame Type: 0x00 

Command code: OxFO 

Command Parameter Length PL: 0x0004 

Mixer Gain Mixer_G: 0x03(Mixer Gain is 9dB) 

IF Amplifier IF_G: OxO6(IF Amplifier IF AMP Gain is 36dB) 


Signal demodulator value Third: 0x01BO (The smaller the Signal demodulated 

value is, the less the demodulator tag return to RSSI, but also with less stable; 
it will unable to be demodulated if lower than a certain value; on the contrary, 
the bigger value, the more demodulated tags return to RSSI; the nearer the 


distance, the more stable). 0x01B0 is the recommended smallest value. 
Checksum: OxAE 


Mixer Gain Chart 


Mixer_G(dB) 


IF AMP Gain Chart 


Components 


We Make Things Intelligent 


IF_G(dB) 


12 


18 


21 


24 


27 


30 


30 


40 


Response Frame Definition 


If the operation to get the channel is correct, then the response frame is: 


PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 


Command Code: OxF0 
Command Parameter Length PL: 0x0001 
Command Parameter: 0x00 
Checksum: OxF1 
2.21 Test RFID input-blocking signal 
Command Frame Definition 


Test RFID input blocking signal Scan Jammer, for testing the reader antenna’s 


blocking signal in every channel in the current area. 


Components 


We Make Things Intelligent 


Header PL(MSB) | PL(LSB) | Checksu 


Frame Type: 0x00 

Command Code: OxF2 

Command Parameter Length PL: 0x0000 
Checksum: OxF2 

Response Frame Definition 


If in China 900MHz frequency, there are 20 channels in total, test if the radio 
input blocking signal Scan Jammer channel operates correctly, then the 
response frame is: 


Header PL(MSB) | PL(LSB) is a JMR(MS 
B) 


00 16 F2 


Fi F5 


JMR(LS | Checksu 
B) m 


F5 DD 


Frame Type: 0x01 

Command code: OxF2 

Command Parameter Length PL: 0x0016 

Test initial channel CH_L: 0x00(Test initial channel Index is 0) 


Test final channel CH_H: 0x13(Test final channel Index is 19) 


Components 


We Make Things Intelligent 


Channel blocking signal JMR: 


OxF2F1FOEFECEAE8EAECEEFOF1F5F5F5F6F5F5F5F5(#£'F0xF2AN-14dBm) 


Checksum: 0xDD 
2.23 Test Channel RSSI 
Command Frame Definition 


Test radio input RSSI signal is for testing if there is reader works in current 


condition. For example: 


Header PL(MSB) | PL(LSB) | Checksu 
m 


BB FS 


Frame Type: 0x00 

Command code: OxF3 

Command Parameter Length PL: 0x0000 
Checksum: OxF3 

Response Frame Definition 


If in China 90O0OMHz frequency, there are 20 channels in total, test if the radio 
input blocking signal Scan Jammer channel operates correctly, then the 


response frame is: 


Header PL(MSB) | PL(LSB) lad ie RSSI(M 
SB) 


00 16 BA 


Components 


We Make Things Intelligent 


RSSI(LS | Checksu 


B) m 


BA A5 


Frame Type: 0x01 

Command code: OxF2 

Command Parameter Length PL: 0x0016 

Test initial channel CH_L: 0x00(Test initial channel Index is 0) 
Test final channel CH_H: 0x13(Test final channel Index is 19) 


Channel blocking signal JMR: 
0xBABABABABABABABABABABABABABABABABABABABA (Among OxBA is - 
70dBm, test RSSI is the least value) 


Checksum: OxDD 
2.24 Control IO port 
Command Frame Definition 


Set the IO port direction, read the electrical level, and set the electrical level. 


As below: 


Header 


PL(MSB 
) 


PL(LSB 
) 


Paramet 
er0 


Paramet 
erl 


Paramet 
er2 


BB 


00 


03 


00 


04 


O01 


Checksu 
m 


22 


Frame Type: 0x00 


Command code: OxiA 


Command Parameter Length PL: 0x0003 


Command Parameter: 0x00 0x04 0x01 


Components 


We Make Things Intelligent 


Checksum: 0x22 


Parameter explanation: 


Descr | Length . 7 
iption 


Para 1 byte Choose the es 
mete 
0 0x00 : Set IO direction ; 
0x01 : Set IO electrical level ; 
Ox02 : Read IO electrical level, 
The pin for the operation is assigned in parameter 
i 


1 byte The parameter value range is 0x01~0x04, 
corresponding to port I01~104 for operation. 


1 byte The parameter value is 0x00 or 0x01. 
Parameter | Parameter2 Description 
0 
0x00 0x00 IO setting is the 
input model 
0x00 0x01 IO setting is the 
output model 
0x01 0x00 Set IO output as a 
low electrical level 
0x01 0x01 Set IO output as a 
high electrical level 
When parameter 0 is 0x02, this parameter is 
insignificant. 


Response Frame Definition 


Response Frame Definition is : 


Header 


PL(MSB 
) 


PL(LSB 
) 


Paramet 
er0 


Paramet 
erl 


Components 


We Make Things Intelligent 


Paramet 
er2 


BB 


00 


03 


00 


04 


O01 


Checksu 
m 


23 


Frame Type: 0x01 

Command code: Ox1A 

Command Parameter Length PL: 0x0003 
Command Parameter: 0x00 0x04 0x01 


Checksum: 0x23 


Descr | Length 
iption 


Para 1 byte Choose the eee 
mete 
6 0x00 : Set IO direction ; 
0x01 : Set IO electrical level ; 
0x02 : Read IO electrical level, 
The pin for the operation is assigned in parameter 
al 


1 byte 


1 byte The parameter value is 0x00 or 0x01. 
Parameter | Parameter2 Description 
0 
0x00 0x00 IO setting failed 
0x00 0x01 IO setting success 


SS 2s 


The parameter value range is 0x01~0x04, 
corresponding to port I01~104 for operation. 


Components 


We Make Things Intelligent 


0x01 0x00 IO output failed 
0x01 0x01 IO output success 
0x02 0x00 Correspond port is a 


low electrical level 


0x02 0x01 Correspond port is a 
high electrical level 


2.25 NXP Read Protect/Reset Read Protect Command 
NXP G2X tag supports Read Protect/Reset Read Protect command. When the 
tag operates the Read Protect command successfully, the tag’s Protect EPC and 
Protect TID bit will be set as ‘1’, and the tag will enter the data protection state. 
If let the tag is back to the normal state from the data protection state, will 
need to operate the Reset Read Protect command. Before operating this 
command, the Select parameter needs to be set for choosing a certain tag to 


operate. 
Command Frame Definition 
Read Protect/Reset Read Protect command frame definition as below: 


PL(MSB) | PL(LSB) | AP(MSB 
nd ) 


BB zal 00 05 00 


AP(LSB) Checksu 
m 


FF E4 


Frame Type: 0x00 
Command code: OxE1 
Command Parameter Length PL: 0x0005 


Kill Password: OxOOOOFFFF 


Components 


We Make Things Intelligent 


Read Protect/Reset Read Protect: 0x00(0x00 means to operate ReadProtect, 


0x01 means to operate Reset Read Protect) 


Checksum: Ox0B 


Response Frame Definition 


If the Read Protect command operates correctly, then the response frame is: 


Header 


PL(MSB) 


PL(LSB) 


PC(MSB 
) 


PC(LSB) 


BB 


00 


10 


30 


00 


EPC(MS 
B) 


30 


EB 


70 


5C 


EPC(LSB 
) 


Paramet 
er 


Checksu 
m 


70 


00 


3D 


Frame Type: 0x01 

Command Code: OxE1 

Command Parameter Length PL: 0x0010 

PC+EPC length UL: Ox0E 

PC: 0x3000 

EPC: 0x30751FEB705C5904E3D50D70 

Command Parameter: Ox00(operate successfully) 
Checksum: 0x3D 


If the Read Protect command operates correctly, then the response frame is: 


Header PL(MSB) | PL(LSB) PC(MSB | PC(LSB) 


EPC(MS 
B) 


Components 


We Make Things Intelligent 


30 


EB 


70 


5C 


EPC(LSB 
) 


Paramet 
er 


Checksu 
m 


70 


00 


3E 


Frame Type: 0x01 

Command code: OxE2 

Command Parameter Length PL: 0x0010 

PC+EPC length UL: Ox0E 

PC: 0x3000 

EPC: 0x30751FEB705C5904E3D50D70 

Command Parameter: Ox00(operate successfully) 
Checksum: Ox3E 


When operating Read Protect (Set/Reset parameter is 0x00) command, if the 
tag is out of the zone, the assigned EPC code is wrong or the tag has no 


response, will return to error code 0x2A, as below: 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 

Command code: OxFF 

Command Parameter Length PL: 0x0001 
Command Parameter: 0x2A 


Checksum: 0x2B 


Components 


We Make Things Intelligent 


When operating Read Protect (Set/Reset parameter is 0x01) command, if the 
tag is out of the zone, the assigned EPC code is wrong or the tag has no 


response, will return to error code 0x2B, as below: 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 

Command code: OxFF 

Command Parameter Length PL: 0x0001 

Command Parameter: 0x2B 

Checksum: Ox2C 

If Access Password is wrong, then will return to the wrong code 0x16 and will 


return all PC+EPC of the operated tag, as below: 


PL(MSB) | PL(LSB) PC(MSB 
) 


BB O01 00 10 34 


PC(LSB) EPC(MS 
B) 


00 30 EB 70 


EPC(LSB | Checksu 
) m 


70 71 


Frame Type: 0x01 
Command code: OxFF 


Command Parameter Length PL: 0x0016 


Command Parameter Error Code: 0x16 


PC+EPC length UL: Ox0E 


PC: 0x3000 


EPC: 0x30751FEB705C5904E3D50D70 


Checksum: 0x71 


2.26 NXP Change EAS Command 


Components 


We Make Things Intelligent 


NXP G2X tag supports the Change EAS command. When the tag operates the 


Change EAS command successfully, the tag’s PSF bit will be set as ‘1’ or ‘0’. 


When setting the PSF bit as ‘1’, the tag will respond EAS_ Alarm command, or 


the tag will fail to respond EAS_ Alarm command. Before operating this 


command, the Select parameter needs to be set for choosing a certain tag to 


operate. 


Command Parameter 


Change the EAS command frame as below: 


Header 


nd 


PL(MSB) 


PL(LSB) 


AP(MSB 
) 


BB 


E3 


00 


05 


00 


AP(LSB) 


Checksu 
m 


FF 


Frame Type: 0x00 


E7 


Command code: OxE3 


Command Parameter Length PL: 0x0005 


Kill Password: OxOOOOFFFF 


Components 


We Make Things Intelligent 


Set/Reset: 0x01(0x01 means to set PSF bit as ‘1’, 0x00 means to set PSF bit 


as ‘0’) 


Checksum: OxE7 


Response Frame Definition 


If the Change EAS command operates correctly, then the response frame is : 


Header 


PL(MSB) 


PL(LSB) 


PC(MSB 
) 


PC(LSB) 


BB 


00 


10 


30 


00 


EPC(MS 
B) 


30 


EB 


70 


5C 


EPC(LSB 
) 


Paramet 
er 


Checksu 
m 


70 


00 


oF 


Frame Type: 0x01 

Command code: OxE3 

Command Parameter Length PL: 0x0010 

PC+EPC length UL: Ox0E 

PC: 0x3000 

EPC: 0x30751FEB705C5904E3D50D70 

Command Parameter: Ox00(operate successfully) 
Checksum: Ox3F 


When operating the Change EAS comman<d, if the tag is out of the zone, a 
certain EPC code is wrong or the tag has no response, will return to error code 


0x1B as below: 


Components 


We Make Things Intelligent 


Header PL(MSB) | PL(LSB) | Paramet | Checksu 
m 


1G 


Frame Type: 0x01 

Command code: OxFF 

Command Parameter Length PL: 0x0001 

Command Parameter: 0x1B 

Checksum: Ox1C 

If Access Password is wrong, then will return to error code 0x16, and will return 


to PC+EPC of all operated tags, as below: 


PL(MSB) | PL(LSB) PC(MSB 
) 


BB 01 00 10 34 


PC(LSB) EPC(MS 
B) 


00 30 EB 70 


EPC(LSB | Checksu 
) m 


70 71 


Frame Type: 0x01 

Command Code: OxFF 

Command Parameter Length PL: 0x0016 
Command Parameter Error Code: 0x16 
PC+EPC length UL: Ox0E 

PC: 0x3000 


EPC: 0x30751FEB705C5904E3D50D70 


Components 


We Make Things Intelligent 


Checksum: 0x71 


2.27 NXP EAS_ Alarm Command 
NXP G2X tag supports EAS_Alarm command. When the tag receives EAS_ Alarm 
command, the tag will return to 64bits EAS-Alarm code immediately. Please 
note the tags will response EAS_Alarm command only when the PSF bit is set 
as ‘1’, or the tag will fail to response EAS_ Alarm command. This command is 


suitable for electrical product security system. 


Command Frame Definition 


EAS_ Alarm Command. 


Header PL(MSB) | PL(LSB) | Checksu 
m 


BB E4 


Frame Type: 0x00 

Command code: OxE4 

Command Parameter Length PL: 0x0000 
Checksum: OxE4 

Response Frame Definition 


If EAS_ Alarm command operates successfully, tag will response and return to 


correct 64bits EAS-Alarm code, then response frame is: 


Header Type Comma | PL(MSB) | PL(LSB) EAS-Alarm 
nd code (MSB) 
BB O01 E4 00 08 69 OA EC 
EAS- Checksum End 
Alarm 
code 
(LSB) 
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D2 15 D8 Fo 80 7E 


Frame Type: 0x01 

Command Code: OxE3 

Command Parameter Length PL: 0x0001 
Command Parameter: 0x00 

Checksum: OxE5 


When operate EAS_ Alarm command, if no tag responses, will return to error 


code 0x1iD as below: 


PL(MSB) | PL(LSB) | Paramet | Checksu 


Frame Type: 0x01 

Command Code: OxFF 

Command Parameter Length PL: 0x0001 
Command Parameter: 0x1D 


Checksum: Ox1E 


4. Command Summary 


Description 


Get the reader’s module information 


Single polling command 


Several times polling command: 


Stop several times frame command 
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Set Select Parameter command 


Set Send Select command 


Read the data storage area of the tag 


Write the Data storage area of the tag 


Lock data storage of tag 


Inactivate kill the tag 


Get Query Parameter 


Set Query Parameter 


Set working zone 


Set working channel 


Get working channel 


Set frequency adjustment 
automatically 


Get transmitting power 


Set transmitting power 


Set transmit a continuous carrier 


Get the parameter of receiving 
modem 


Set the parameter of receiving modem 


Test RFID input-blocking signal 


Test RSSI channel 


Control IO port 


NXP Read Protec/Reset Read Protect 
command 


NXP Change EAS command 
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NXP EAS-Alarm command 


5. Command frame operates failure 
summary 


If the command frame fails to operate, then the VM-5GA chip sends the operate 
failure response frame to the upper computer. The operate failure response 
frame shares command code OxFF. If fail to get the tag’s EPC before operating 
failure, then the command parameter fix is a 1-byte error code. If successful to 
get the tag’s EPC, then the response parameter is a 1-byte error code plus the 
tag’s PC+EPC data. 


For example, if the polling command frame fails to operate, fails to receive tag 
return, or returns data CRC ECC error, then will return error code 0x15. 


Header Command | PL(MSB | PL(LSB) | Parameter | Checksum 
) 


00 


Frame Type: 0x01 
Command code: OxFF (OxFF represents command frame operates fail) 
Command Parameter Length PL: 0x01 


Command Parameter: Ox15(error code is a return code from the failed 


operation) 


Checksum: 0x16 


Error Command Summary as below: 


Type 


Command 
Error 
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Command code error in command frame. 


FHSS Fail 


Frequency Hopping searching channel time 
out. All channels are occupied during this 
period. 


Inventory 
Fail 


Polling operates failure. No-tag returns or 
return data CRC ECC error. 


Access Fail 


The access tag failed, maybe the access 
password is wrong. 


Read Fail 


Fail to read tag data storage zone. Tags fail to 
return or return data CRC ECC error. 


Read Error 


OxAO | Error 
code 


Fail to read tag data storage zone. Return 
code is got from OxA0 or Error Code. Detail 
error Code information please sees the below 
chart. 


Write Fail 


Fail to write tag data storage zone. Tags fail 
to return or return data CRC ECC error. 


Write Error 


OxBO | Error 
code 


Fail to write tag data storage zone. Return 
code is got from OxBO or Error Code. Detail 
error Code information please sees the below 
chart. 


Lock Fail 


Fail to lock tag data storage zone. Tags fail to 
return or return data CRC ECC error. 


Lock Error 


OxCo | Error 
code 


Fail to lock tag data storage zone. Return 
code is got from OxCO or Error Code. Detail 
error Code information please sees the below 
chart. 


Kill Fail 


0x12 


Fail to kill tag. Tags fail to return or return 
data CRC ECC error. 


Kill Error 


OxDO | Error 
code 


Fail to kill tag. Return code is got from 0xCO 
or Error Code. Detail error Code information 
please sees the below chart. 


NXP G2X Tag specific command error code : 
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Read Protect Fail command, Tags fail 
Read Protect Fail to return or return data CRC ECC 
error. 


Reset Read Protect Fail command, 
Tags fail to return or return data CRC 
ECC error. 


Reset Read Protect 
Fail 


Change EAS Fail, Tags fail to return 


Change EAS Fail or return data CRC ECC error. 


NXP TAG specific return command 
OxEO | Error | error code, error code is got from 

code OxE0 or previous tag return Error 
Code. 


NXP TAG specific 
return command 
error code 


EPC Gen2 protocol tag return error code: 


Tag error-code 


Error-code Error Code Error code Error Description 


Other errors didn’t 


000000002 | Other error inform in this chart. 


A specific tag data 
storage zone no exists; 
Memory or this tag didn’t 
overrun support the specific 
length of EPC, such as 
XPC. 


000000112 


Error-specific The specific tag data 


storage zone is locked 
Memory and/or locked forever, 
locked and the locking state 
cannot be written or 
read. 


000001002 


Tag didn’t have 
000010112 sufficient power to 


Insufficient 


ower : 
P write. 
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Non-specific The tag didn’t support 


Non-specific | 000011112 
error an Error-code return. 
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